Quiz

First check if the total time for the attempt is a bit longer that the time limit (which would suggest that it was submitted automatically by the batch process after the time limit, rather than being submitted by the student before the time limit).

Unfortunately, when you review a quiz attempt in the interface, the response history table underneath each question does not show who performed each action, even though that is stored in the database. So, that option is not easily available. However, if you are able to use this database query, you can get that info https://docs.moodle.org/dev/Overview_of_the_Moodle_question_engine#Detailed_data_about_an_attempt.